7fcfbf479e1b46e9187ac70a2d9a236e156c84cc0bf05f83b38741758e82e08d

Analysis

max time kernel
91s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 04:41

Target

VISPLOIT.exe
Size

199KB
MD5

e00a60834438fc5d940888b913121c3b
SHA1

e52940fd8ce5c390af4f87b0f54b7cfe9a126798
SHA256

7fcfbf479e1b46e9187ac70a2d9a236e156c84cc0bf05f83b38741758e82e08d
SHA512

6e491da4c6d999a8393f1e87962997882cc0141ac555d501990810e3409d1494225553cbe7a7afc610e1c3ccbb50f7032f4126562d15df3daafb7ab2a7098cd7
SSDEEP

1536:OtFL3fvwu9SkZKJH2zQy4WblNeG1ath5NZQK3eWj/NQhTXH:Oj3fvwu9SkQH2ZfbOx5Nmclkj

Score

1^/10

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 3304	644	VISPLOIT.exe	83
PID 644 wrote to memory of 3304	644	VISPLOIT.exe	83
PID 3304 wrote to memory of 1400	3304	cmd.exe	84
PID 3304 wrote to memory of 1400	3304	cmd.exe	84
PID 644 wrote to memory of 3788	644	VISPLOIT.exe	85
PID 644 wrote to memory of 3788	644	VISPLOIT.exe	85
PID 3788 wrote to memory of 4756	3788	cmd.exe	86
PID 3788 wrote to memory of 4756	3788	cmd.exe	86
PID 644 wrote to memory of 2704	644	VISPLOIT.exe	87
PID 644 wrote to memory of 2704	644	VISPLOIT.exe	87

C:\Users\Admin\AppData\Local\Temp\VISPLOIT.exe
"C:\Users\Admin\AppData\Local\Temp\VISPLOIT.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con cols=85
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\system32\mode.com
    mode con cols=85
    3⤵
    PID:1400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con lines=25
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\system32\mode.com
    mode con lines=25
    3⤵
    PID:4756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c TITLE Visploit
  2⤵
  PID:2704